darroyo
de5f7ca4ee
Cleanup: remove dead auth middleware and fix security log leak
...
CI / test (push) Failing after 12m28s
- Remove dead AdminOnly() and AdminTokenAuth() middleware (unused since JWT switch)
- Remove dead RequireScope() middleware (also unused)
- Fix seed.go: only log password when auto-generated (was logging every time)
- Fix seed.go: use admin.Username (normalized) instead of raw username in log
- Simplify generateRandomPassword: 12 bytes (24 hex chars) instead of 24 bytes then truncate
- Me handler: use claims.Subject (UUID) for lookup instead of username
- Remove unused /logout endpoint (stateless JWT)
2026-07-31 17:26:31 -04:00
darroyo
ddc73957cb
Fix: move keys and model-load routes under /api/v1/admin prefix
...
CI / test (push) Failing after 12m38s
Routes now consistently under admin session auth:
- /api/v1/admin/keys (GET, POST, DELETE)
- /api/v1/admin/models/:name/load (POST)
Rebuilt frontend assets.
2026-07-31 17:17:23 -04:00
darroyo
4d34c6d31a
Replace token-based admin auth with JWT session authentication
...
CI / test (push) Failing after 12m45s
- Add AdminUser model (bcrypt hashed passwords) and admin_users table
- Add AdminJWTService for HS256 JWT sessions (24h TTL)
- Add AdminSessionAuth middleware for /api/v1/admin/* routes
- Add admin handlers: login, logout, me, change-password, users CRUD
- Keys and model management routes now require admin JWT session
- Remove ADMIN_TOKEN, add ADMIN_USERNAME, ADMIN_PASSWORD env vars
- Update frontend: username/password login, admin_session storage, AdminUsers CRUD view
2026-07-31 17:15:29 -04:00
darroyo
b18d4bd146
fix: use mime.TypeByExtension for static asset Content-Type
...
CI / test (push) Failing after 12m25s
http.DetectContentType() cannot detect JS, CSS, SVG, etc. from magic
bytes — it falls back to text/plain, causing browsers to reject module
scripts with 'Expected a JavaScript module' error.
Use mime.TypeByExtension(ext) which correctly maps .js ->
application/javascript, .css -> text/css, etc.
2026-07-31 15:37:16 -04:00
darroyo
0d6c8c7989
Add embedded Vue SPA admin panel with go:embed
...
CI / test (push) Failing after 13m11s
This is the complete fix for the missing /admin/ route and frontend serving:
Backend:
- internal/web/web.go: new package with go:embed for web/dist/
- internal/api/router.go: add routes for /admin/, /admin/*, /assets/*
- internal/db/db.go: fix SQLite DSN parsing (sqlite:///path -> path)
Build system:
- Makefile: new 'embed-prep' target copies web/dist to internal/web/dist
- make build now runs embed-prep -> frontend/build automatically
Deployment:
- deploy/llamalink.service: remove invalid --host/--port flags,
add EnvironmentFile=/etc/llamalink/env
Verified:
- /health returns 200
- /admin/ serves Vue SPA HTML
- /assets/* serves CSS and JS files from embedded FS
- sqlite:///./llamalink.db works correctly
2026-07-31 14:47:15 -04:00
darroyo
fb5ae6ceb5
Fix staticcheck SA4000 in TestDurationHelpers
...
CI / test (push) Failing after 12m33s
Compare against expected values (300s, 20s, 5s) instead of self-comparison
2026-07-30 18:14:51 -04:00
darroyo
c2feb1bc75
Fix CI: add if-no-files-found=warn to coverage upload, add config tests
...
CI / test (push) Failing after 12m39s
- .github/workflows/ci.yml: upload-artifact if-no-files-found=warn
- internal/config/config_test.go: 93.5% coverage smoke tests for Load,
env overrides, URL helpers, duration helpers, Logger, boolEnv
2026-07-30 17:42:28 -04:00
darroyo
f775c2f67e
Fix golangci-lint errcheck and unused errors
...
CI / test (push) Failing after 12m57s
- manager.go: add _ = to syscall.Kill and proc.Signal calls (6 fixes)
- chat.go: add _ = to c.Writer.WriteString calls (9 fixes)
- webhook.go: remove unused webhookSecret field
2026-07-30 17:20:34 -04:00
darroyo
4c9ed3c24b
Initial commit: LlamaLink Go rewrite
...
Complete rewrite from Python/FastAPI to Go/Gin:
- Go backend: auth (API keys + bcrypt), llama.cpp subprocess manager,
hot-swap multi-model, rate limiting, quota system, webhooks
- Vue 3 SPA admin panel (src/) with Tailwind CSS
- Deployment: Docker multi-stage, docker-compose, nginx, systemd
- GORM/SQLite models: ApiKey, Model, UsageLog, Quota, Webhook
- REST API: /api/v1/admin/* (keys, models, chat, usage, health)
- Embedded frontend via go:embed (build output at web/dist/)
Removed legacy Python artifacts (app/, tests/, pyproject.toml, etc.)
2026-07-30 10:58:55 -04:00
darroyo